CREST vs CHECK Penetration Testing: Which Accreditation Does Your Organisation Need?

Anyone shopping for a penetration testing provider in the UK will almost immediately run into two acronyms: CREST and CHECK. They sit side by side on provider websites and in tender documents, so it’s easy to assume they’re two versions of the same thing, or that one is simply a higher grade of the other.

In reality, they’re quite different. 

CREST is an independent industry body that accredits penetration testing companies and certifies individual testers, whereas CHECK is a scheme run by the National Cyber Security Centre (NCSC), built specifically for government, the wider public sector, and critical national infrastructure (CNI).

This guide explains what each one means, who genuinely needs CHECK penetration testing, and why most private businesses don’t.

The Short Answer

If you only have a minute, here’s the summary:

• You need a CHECK provider if you’re a central government department or agency testing systems that handle data marked official or above, or if a contract or tender explicitly asks for CHECK.
• CHECK is strongly recommended for other public sector bodies, and the scheme was designed with CNI operators in mind.
• Almost everyone else is best served by a CREST-accredited provider, meaning that the company and its testers have been independently assessed against recognised industry standards.

Interestingly, this isn’t only a provider’s view. The NCSC’s own information for CHECK buyers states that if your organisation is not in the public sector, you don’t need to have penetration testing carried out by a CHECK service provider.

What is CREST?

CREST is a not-for-profit accreditation and certification body for the technical security industry. Founded in the UK in 2006, it now operates internationally, which is why you’ll find CREST-accredited providers in countries such as Australia, Singapore, and the United States, as well as the UK.

CREST works at two levels, and the terms are often used loosely:

• Company accreditation: CREST assesses how a provider actually runs its penetration testing service, including its testing methodology, how it handles client data, the quality of its reporting, how it deals with complaints and how closely it follows a professional code of conduct.
• Individual certification: Testers sit CREST exams at different levels, such as CPSA, CRT (CREST Registered Tester) and CCT (CREST Certified Tester), which demonstrate their technical ability.

Crucially, “CREST accredited” and “CREST certified” mean different things. A company that employs a certified tester isn’t automatically an accredited company, and general CREST membership isn’t the same as accreditation for penetration testing. You can confirm a provider’s status on the CREST Marketplace, which lists every accredited company alongside the services it is accredited for.

We go into much more detail in our guide to CREST penetration testing, including what the accreditation process involves and how to verify a provider before you sign anything.

What is CHECK?

CHECK is the NCSC’s assurance scheme for penetration testing. Under CHECK, NCSC-assured companies are authorised to carry out penetration tests on public sector and CNI systems and networks. 

You’ll often see the term alongside the IT Health Check, or ITHC, which is the name commonly given to the security assessment that government bodies commission.

CHECK has no membership fee or industry board because the NCSC runs it directly, assesses every company that offers CHECK services to ensure its methodology meets the NCSC standard, and regularly audits CHECK reports to ensure that standard holds. That’s why you’ll see providers describe themselves as CHECK approved or CHECK accredited, although the NCSC’s own wording is “assured”.

The scheme sets firm requirements for the people who carry out the testing and for the company that employs them:

• CHECK Team Leaders (CTLs) must hold a UK Cyber Security Council professional title in Security Testing at Principal level or above.
• CHECK Team Members (CTMs) must hold a UK Cyber Security Council title at Practitioner level or above.
• Every CTL and CTM must hold valid Security Check (SC) clearance at a minimum.
• The company itself must hold Cyber Essentials Plus, which is the audited level of the government-backed Cyber Essentials scheme, according to the NCSC’s information for CHECK providers.

How CHECK pen testing has changed recently

The rules for testers have shifted noticeably over the last two years. Version 1.1 of the CHECK Scheme Standard, dated the 7th of November, 2024, removed the old list of “approved exams” and replaced it with the UK Cyber Security Council’s professional titles.

According to CREST’s guidance on the change, Team Leaders had until the 31st of March, 2025, to obtain their Principal (or Chartered) title, and Team Members had until the 31st of March, 2026, to obtain their Practitioner title. Anyone who missed their deadline can no longer work on CHECK engagements until they hold the right title.

Exams haven’t disappeared entirely, though. Title holders are still expected to hold a valid technical certificate, such as CREST’s CRT or CCT, or The Cyber Scheme’s equivalent CSTM and CSTL exams, which is one reason why CREST and CHECK keep turning up in the same conversation.

CREST vs CHECK Side by Side

Who Actually Needs CHECK Penetration Testing?

CHECK applies in a handful of specific situations, so it helps to take them one at a time.

Central government departments and agencies

The NCSC’s guidance is that all systems processing data protectively marked official and above, up to Top Secret (but excluding STRAP systems), should be assessed by companies assured under CHECK. For a central government department, CHECK is effectively the default.

The wider public sector

For other public sector bodies, the NCSC strongly recommends that all systems are assessed by a CHECK company, unless the system’s risk owner explicitly advises otherwise. In practice, this group covers organisations such as local councils, NHS bodies and many education providers.

Notably, this is a strong recommendation rather than an absolute rule, which means that the final decision sits with whoever owns the risk for that system. Some public sector organisations always insist on CHECK, while others decide that a CREST-accredited provider gives them the assurance they need for a particular system. 

Schools are a good example because a school or multi-academy trust should check its own policy, and any requirements set by its local authority, before going out to market.

Critical national infrastructure

The scheme was developed with CNI operators in mind, such as energy, water, transport and telecommunications providers, because a compromise in those sectors has such serious consequences. 

In any given case, the need for a CHECK provider usually comes down to the sector regulator, the contracts, and the organisation’s appetite for risk. 

Organisations running operational technology also need a provider with genuine experience of ICS and SCADA testing, which is a separate question from accreditation altogether.

Suppliers to government

Private companies that host, process or connect to government systems under contract may find that their customer requires CHECK testing as part of the agreement. In that case, the requirement comes from the contract rather than the scheme, so read the contract or tender specification closely, because it will normally spell out exactly what’s expected.

Why Most Private Businesses Don’t Need CHECK

For a law firm, a software company, a manufacturer or a financial services business, CHECK is very unlikely to be relevant. There are three main reasons for this:

1. The NCSC doesn’t expect it. 

As mentioned above, the NCSC says plainly that organisations outside the public sector don’t need a CHECK provider, and it points them towards its general guidance on commissioning a penetration test instead.

1. Your stakeholders are asking for something else. 

Customer security questionnaires, cyber insurance applications, ISO 27001 audits, PCI DSS, and the expectations of the FCA and DORA all tend to require independent testing by a qualified, reputable provider. In the UK, CREST accreditation is the benchmark most of them recognise, which is why CREST penetration testing has become the standard expectation across the private sector.

1. CHECK’s requirements exist for government reasons. 

SC clearance, NCSC report audits, and CHECK-specific methodology exist because central government and CNI handle classified information and nationally important systems. For a private business, insisting on CHECK can shrink your pool of potential providers without adding assurance relevant to your actual risks.

Perhaps most importantly, neither badge tells you whether you’re testing the right things. An accreditation tells you a provider meets a recognised standard, but it says nothing about how well your scope reflects how attackers would target your organisation. 

Plenty of businesses commission an accredited test every year, receive a near-identical report and assume they’re secure. We call this the Pentest Trap, and for most organisations it’s a far bigger risk than picking the “wrong” accreditation.

How CREST and CHECK Overlap

Rather than competing, more often than not, the two schemes overlap. Many CHECK companies are also CREST-accredited, and many CHECK testers hold CREST certifications, one of the recognised ways to evidence the technical competence behind a UK Cyber Security Council title.

Holding one doesn’t grant the other, however, and a CREST-accredited company only becomes a CHECK company once the NCSC has separately assured it, and only NCSC-assured companies can describe their work as CHECK testing. If a provider claims CHECK status, you can confirm it on the NCSC’s list of assured CHECK providers.

Four Questions That Settle It

If you’re still unsure which one you need, run through these in order:

1. Are you central government, or are you testing systems that handle government data marked OFFICIAL or above? If so, you need a CHECK provider.
2. Are you a public sector body or part of the UK’s critical national infrastructure? If so, CHECK is strongly recommended, or likely expected, so speak to the system’s risk owner and check what your regulator requires before deciding otherwise.
3. Does a contract, tender or framework name CHECK explicitly? If so, you need a CHECK provider for that piece of work.
4. None of the above? Choose a CREST-accredited provider and focus on getting the scope right.

Conclusion & Next Steps

Once the accreditation question is settled, the more useful question is how to get real value from your testing. Accreditation sets a baseline, but the quality of a test depends on the people doing it and the thinking that goes into the scope.

Look for a provider that offers consultant-led penetration testing, meaning that you speak to an experienced tester rather than a salesperson while the work is being scoped. A cybersecurity risk assessment is a sensible starting point because it shows where your real exposure lies before you decide what to test.

If you’ve been testing the same things every year, your scope is probably overdue for a rethink, since your environment has almost certainly changed since your last test.

Not Sure Which You Need? Talk to Fortifi

Fortifi is a CREST-accredited penetration testing company, and our UK penetration testing services cover networks, web applications, cloud environments, LLMs, red teaming and more. We work with organisations across the private and public sectors, including schools, healthcare providers, law firms and financial services businesses.

If you can’t tell which of the two your organisation needs, we’ll give you a straight answer, even when that answer is that a particular piece of work needs a CHECK provider. We don’t do sales calls, so you’ll speak directly to a cybersecurity expert who can help you understand your obligations and scope a test around your real risks.

Book a call with our team today.

CREST and CHECK: Common Questions

Is CHECK better than CREST?

Not in a general sense. CHECK is a more specialised scheme with stricter personnel requirements, such as SC clearance, because it was built for government and CNI systems. For a private business, a CREST-accredited provider is usually the more appropriate choice, and opting for CHECK wouldn’t make your test any more relevant to your risks.

Can a private company use a CHECK provider?

Yes. Nothing stops a private organisation from commissioning a CHECK company, and some do so to meet the same standard the government applies. For most private businesses, though, it isn’t necessary.

Is CHECK the same as an IT Health Check?

They’re closely related. An IT Health Check (ITHC) is the security assessment that government bodies commission, often when connecting to government networks or accrediting a system, and it’s typically delivered by a CHECK provider. CHECK is the assurance scheme, while an ITHC is the test itself.

Do public sector organisations always have to use CHECK?

Not always. Central government departments should use CHECK for systems handling OFFICIAL data and above. For other public sector bodies, the NCSC strongly recommends CHECK, but the system’s risk owner can decide otherwise.

Can a company be both CREST-accredited and CHECK-assured?

Yes, and many are. The two are assessed separately, by CREST and the NCSC respectively, so a company needs to meet both sets of requirements to hold both.

How do I verify a provider’s CREST or CHECK status?

For CREST, search the CREST Marketplace and confirm that the company is accredited specifically for penetration testing. For CHECK, use the NCSC’s list of assured CHECK providers. Either way, ask who will actually carry out your test and which qualifications they hold.